End of the trail

Between 1998 and February 2009, accountant James T. Hammes embezzled more than $8.7 million from his employer, G&J Pepsi-Cola Bottlers Inc. He was indicted shortly thereafter on 75 counts — including 38 for wire fraud and 36 for money laundering — but wasn’t arrested until May 16, 2015. (See the FBI release, FBI Announces Arrest of Fugitive Suspect James T. Hammes, May 18, 2015.) Why did it take so long to arrest Hammes? After the FBI had questioned him in 2009 about the theft, he left his family and life, and began hiking the Appalachian Trail (AT).

According to a July 1, 2015, SB Nation article by William Browning, Hammes hiked the AT for six years with the moniker, “Bismarck.” Nobody suspected this friendly man with a bushy beard had embezzled millions from his employer. (See A Long Walk’s End, by Browning.)

The end of the trail

In May 2015, more than six years after Hammes was indicted, a hiker — who had met Hammes on the AT — recognized Hammes from his mug shot on the CNBC series “American Greed” and tipped off the FBI. After investigating, the FBI found Hammes at the Montgomery Homestead Inn in Damascus, Virginia — adjacent to the AT — during the annual Trail Days festival. According to the inn’s manager, Hammes was a frequent visitor. At his arrest, according to federal court records, he was carrying $11,854, a gold ring, 12 gift cards worth $3,604.87, plus two laptops, thumb drives and cellphones. He’d also been using the stolen identity of a G&J employee.

The fraud scheme begins

In 1995, G&J hired Hammes to be its controller for the Southern division in Lexington, Kentucky. He was responsible for all financial accounting and internal controls in his region, so he had access to all G&J’s bank accounts, including the operating account it used to pay vendors. (See the U.S. Attorney’s Office Southern District of Ohio’s release, Former Fugitive Pleads Guilty, Oct. 23, 2015.)

Hammes first embarked on his theft scheme at G&J in March 1998 when he easily created an unauthorized payable account for an existing vendor, Zumbiel, which provided plastic wrap materials for Pepsi bottles.

Hammes also abused the relationship between G&J and Zumbiel by creating an unauthorized bank account in Zumbiel’s name at National City Bank, which wasn’t the bank Zumbiel used. Hammes used his name and his personal address on the authorized signature card for the fake Zumbiel account. He’d make payments from the false Zumbiel accounts payable and deposit them in the false Zumbiel bank account.

As G&J’s controller, Hammes supervised the entire accounts payable department by reviewing invoices and approving payments to vendors. He’d bring a check request form (with no supporting documentation) to an accounts payable clerk and instruct them to cut a check using the false Zumbiel vendor code. He’d then direct his staff to give him the check. To cover his tracks, Hammes would use a miscellaneous account to charge off the fraudulent checks. (Court documents show that the accounts payable clerk believed the accounts were legitimate.) He’d also make changes in other legitimate accounts to offset the amounts of the checks. Hammes would send the manipulated monthly accounting reports, which misrepresented the true financial portrait of the company, to G&J headquarters.

Once he’d have a check in hand, he’d deposit the funds into the fake Zumbiel account at National City Bank. (An investigator’s review of the backs of the checks showed that Hammes endorsed them with his own signature.) He’d then transfer the stolen funds into either of his two personal bank accounts — one of which was a brokerage account at TD Ameritrade Bank. Shortly after his indictment, the FBI and U.S. Attorney’s Office Southern District of Ohio filed a civil forfeiture action to seize and recover the funds in both personal bank accounts (more than $500,000 in the TD Ameritrade brokerage account and nearly $200,000 in his Fifth-Third Bank account).

Discovery of the theft

An internal audit conducted on Feb. 19, 2009, might’ve been the catalyst that raised suspicion of Hammes’s fraud. Initially, the internal review showed that $4.6 million had been stolen, but that review only went back to 2005. The company immediately called the FBI, which began an investigation. Interestingly, Hammes last transferred funds to his account on Feb. 18 — one day before the internal audit.

On Feb. 23, 2009, the FBI interviewed Hammes. While the contents of the interview aren’t public, the FBI interviewers might’ve confronted Hammes about the second unauthorized vendor code and the fake Zumbiel bank account. Following the interview, Hammes fled and went missing for the next six years. A federal judge issued an arrest warrant only eight days after the FBI received the initial complaint. (See Trail hiker pleads guilty to wire fraud in embezzling case, by Dan Sewell, Cincinnati.com, Oct. 23, 2015.)

Lessons in prevention and detection

Hammes embezzled $8,711,282.42 over 11 years. He successfully perpetrated his false vendor scheme for so many years because of several weaknesses in internal controls. Dr. Joseph T. Wells, CFE, CPA, founder and Chairman of the ACFE, notes in his book Principles of Fraud Examination (4th edition, 2013, Wiley) that false vendor invoices are a form of the basic false billing scheme. (This book is the university textbook edition of Dr. Wells’s Corporate Fraud Handbook.) Dr. Wells writes that “most billing schemes succeed when an individual has control over one or more aspects of purchasing, authorizing purchases, receiving and storing goods and issuing payments.”

Hammes had special access and authorization to approve payments, review invoices and create new vendors. If even one person had questioned Hammes and investigated further, they might’ve noticed that none of the payments to the false Zumbiel account was supported by legitimate invoices or other supporting documentation. Also, anyone investigating should’ve discovered that Zumbiel had two different accounts payable vendor codes.

Hammes didn’t stop his crimes after committing the false vendor scheme to pilfer the funds from his employer. He also laundered the proceeds of his fraud and wired millions of stolen dollars across state lines through ACH withdrawals into his TD brokerage account and possibly other unconfirmed places. If internal or external auditors (or anyone in any G&J department) had carefully reviewed Hammes’s work, the company would’ve avoided the fraud. Of course, we know it’s easier to prevent fraud than to detect and correct it. The key to successful internal controls is always proper segregation of duties.

In addition to these suggestions for prevention of billing schemes, the ACFE’s Fraud Examiners Manual details additional tools, red flags and observations. (See page 1.455, 2018 Fraud Examiners Manual.)

• Compare all the accounts payable vendor accounts and clean them up. A vendor might have legitimate reasons to have two different codes, but this should be rare and well-documented (and audited frequently).
• When possible, ask for supplemental documents such as receipts or invoices. Hammes didn’t provide these, which should’ve been a huge red flag, especially when he directed a subordinate employee to pay checks without any justification.
• Reconcile the checks, especially the fronts and backs, to determine who endorsed them and in what bank they were deposited. Investigate any anomalies or inconsistencies.

Life on the lam ends

Almost seven-and-a-half years after Hammes was indicted, he was sentenced on June 22, 2016, to 96 months in prison and ordered to pay restitution of $7,680,259.17 for one count of wire fraud. He was also ordered to forfeit the property seized at his arrest. (See the U.S. Attorney’s Office Southern District of Ohio’s release, Former Fugitive Sentenced, June 22, 2016.) The scope of Hammes’s fraud against G&J will never be known because G&J’s impact statement was filed under seal. But the harm was likely substantial and well beyond the $7.6 million stolen (United States v. Hammes, 2016).

The loss of trust and employee morale, diverted attention of management, and hiring of outside counsel and auditors all likely contributed to massive company expenses. Even Hammes’s own attorney noted that the theft was so huge and hurt many victims beyond G&J. But at its essence, the embezzlement was simply stealing — a lot! Hammes’s attorney wrote to the court that the scheme’s “success was a direct result of [his] position in the company and the trust that was bestowed upon him.” (See Lawyers: Appalachian Trail was client’s ‘road to redemption,’ WLWT5, June 3, 2016.) Isn’t that true of almost all embezzlers?

Scott Morantz, CPA, is a senior auditor at SC&H Group, P.A. in Sparks, Maryland. He adapted this column from a paper he submitted in Colin May’s “Documentary Evidence and Investigative Technique” course at Stevenson University in Owings Mills, Maryland. Contact him at smorantz@scandh.com. 

Colin May, CFE, is a forensic auditor and former special agent for two federal agencies, and frequently writes for Fraud Magazine. He’s also an adjunct professor of forensic studies at Stevenson University. Contact him at cmay3231@stevenson.edu.